> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CSPM Integrations

> Information about the CSPM integrations available in Leen. Find out which fields are supported by each integration and how to configure them.

## Supported Alert Fields

| Leen Model | Microsoft Defender for Cloud | Lacework CSPM | Wiz CSPM |
| - | - | - | - |
| `id` | ✅ | ✅ | ✅ |
| `vendor` | ✅ | ✅ | ✅ |
| `title` | ✅ | ✅ | ✅ |
| `description` | ✅ | ✅ | ✅ |
| `severity` | ✅ | ✅ | ✅ |
| `vendor_severity` | ✅ | ✅ | ✅ |
| `status` | ✅ | ✅ | ✅ |
| `vendor_status` | ✅ | ✅ | ✅ |
| `vendor_data` (Additional vendor specific data) | ✅ | | ✅ |

## Supported Compliance Findings

| Leen Model | Microsoft Defender for Cloud | Lacework CSPM | AWS SecurityHub | Wiz CSPM |
| - | - | - | - | - |
| `id` | ✅ | ✅ | ✅ | ✅ |
| `vendor_id` | ✅ | ✅ | ✅ | ✅ |
| `vendor` | ✅ | ✅ | ✅ | ✅ |
| `title` | ✅ | ✅ | ✅ | ✅ |
| `description` | ✅ | ✅ | ✅ | ✅ |
| `remediation` | ✅ | | ✅ | ✅ |
| `severity` | ✅ | ✅ | ✅ | ✅ |
| `vendor_severity` | ✅ | ✅ | ✅ | ✅ |
| `status` | ✅ | ✅ | ✅ | ✅ |
| `vendor_status` | ✅ | ✅ | ✅ | ✅ |
| `vendor_data` (Additional vendor specific data) | ✅ | | | ✅ |
| `start_time` | ✅ | ✅ | ✅ | ✅ |
| `status_changed_at` | ✅ | ✅ | ✅ | ✅ |
| `resource_id` | ✅ | | ✅ | ✅ |
| `resource_type` | ✅ | | ✅ | ✅ |
| `resource_name` | ✅ | | | ✅ |
| `resource_region` | | | ✅ | ✅ |
| `compliances` | ✅ | ✅ | ✅ | ✅ |
| `rule` | ✅ | ✅ | ✅ | ✅ |

## Rules

A control states an outcome; a rule is one criterion behind it. "Ensure diagnostic settings
capture the right categories" can be failed for several separate reasons, and a rule is the one
each finding actually failed.

Ask for them with `includeRules=true` on [List Compliance Data](/api-reference/cspm/get-compliance-data)
and `includeRule=true` on [List Compliance Findings](/api-reference/cspm/get-compliance-findings).
Both are opt-in: a request without them returns exactly what it returned before.

A control then carries `rules`, each with the counts the tool publishes for that rule **under that
control**, plus `rule_counts` summarising how many of its rules pass, fail or do not apply, and
how many carry no state because the tool published none (`unknown`). The four always add up to
`total`. A finding carries `rule`, the criterion it failed, as `{id, vendor_id, name}`.

The counts belong to the pairing of a rule and a control, not to the rule alone: one criterion
cited by two controls can report different numbers under each, and Leen keeps both rather than
picking one.

| Leen Model | Microsoft Defender for Cloud | Lacework CSPM | AWS SecurityHub | Wiz CSPM |
| - | - | - | - | - |
| `name` | ✅ | ✅ | ✅ | ✅ |
| `vendor_id` | ✅ | ✅ | ✅ | ✅ |
| `description` | ✅ | ✅ | ✅ | ✅ |
| `remediation` | ✅ | ✅ | ✅ | ✅ |
| `severity` | ✅ | ✅ | ✅ | ✅ |
| `rule_kind` | ✅ | ✅ | | ✅ |
| `state` (under a control) | ✅ | ✅ | Disabled controls only | Derived ² |
| `passed_resources` | ✅ | Derived ¹ | | |
| `failed_resources` | ✅ | ✅ | | Derived ² |
| `skipped_resources` | ✅ | ✅ | | Derived ² |
| `unsupported_resources` | ✅ | Derived ¹ | | |
| `logic_language` | | ✅ | | ✅ |

**Derived** means Leen computes the value because the tool does not publish it:

1. Lacework reports assessed, violating and suppressed resources for each recommendation, but no
   passing count. Leen sets `passed_resources` to assessed minus violating minus suppressed, and
   `unsupported_resources` to resources in scope minus assessed. This assumes suppressed resources
   are counted within assessed ones; no tenant measured so far has had a suppressed resource to
   confirm it. Where the counts contradict that assumption, `passed_resources` falls back to
   assessed minus violating.
2. Wiz publishes no state or count for a control under a framework. Leen derives them from the
   control's Issues: `failed_resources` is the number of open Issues and `skipped_resources` the
   number of rejected ones, so both count Issues rather than resources. `state` is
   `NOT_APPLICABLE` for a disabled control, `FAIL` while it has an open Issue and `PASS` otherwise.

<Note>
  A field a tool does not publish comes back empty rather than guessed: an empty string for text,
  and null for a count or a state. Microsoft Defender for Cloud, for example, publishes no
  unsupported-resource count and no rule logic, and a definition nothing in the tenant is assessed
  against carries no description, remediation or severity. AWS Security Hub publishes no
  resource counts at all, so its counts are null rather than 0.
</Note>

For any additional information about our field mappings or integrations please contact us.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.